Analysis
-
max time kernel
147s -
max time network
164s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
29-05-2022 21:36
Static task
static1
Behavioral task
behavioral1
Sample
0d286ef4e3e5c8462a89727efe309b3fead46486590ab5d39f09a457060e38c6.exe
Resource
win7-20220414-en
0 signatures
0 seconds
General
-
Target
0d286ef4e3e5c8462a89727efe309b3fead46486590ab5d39f09a457060e38c6.exe
-
Size
501KB
-
MD5
b10331a3adbcbaeb291fdd3aaa0b6be4
-
SHA1
d82f75044514ae3e41fdeda8110b6d1e126044d2
-
SHA256
0d286ef4e3e5c8462a89727efe309b3fead46486590ab5d39f09a457060e38c6
-
SHA512
8c237a3421886075eb4e041864d5e4e01bab3f9100222a0e515bfb46d75dc59c4e3770b36b0e14c07ec1bfb346831948f6a38ce8979c39c810ed463e4127f234
Malware Config
Extracted
Family
limerat
Attributes
-
aes_key
lavin
-
antivm
false
-
c2_url
https://pastebin.com/raw/kgLg0ny1
-
delay
3
-
download_payload
false
-
install
false
-
install_name
Wservices.exe
-
main_folder
Temp
-
pin_spread
false
-
sub_folder
\
-
usb_spread
false
Signatures
-
Processes:
resource yara_rule behavioral1/memory/624-55-0x0000000001100000-0x0000000001226000-memory.dmp upx behavioral1/memory/624-66-0x0000000001100000-0x0000000001226000-memory.dmp upx -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral1/memory/624-55-0x0000000001100000-0x0000000001226000-memory.dmp autoit_exe behavioral1/memory/624-66-0x0000000001100000-0x0000000001226000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
0d286ef4e3e5c8462a89727efe309b3fead46486590ab5d39f09a457060e38c6.exedescription pid process target process PID 624 set thread context of 1724 624 0d286ef4e3e5c8462a89727efe309b3fead46486590ab5d39f09a457060e38c6.exe RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
RegAsm.exedescription pid process Token: SeDebugPrivilege 1724 RegAsm.exe Token: SeDebugPrivilege 1724 RegAsm.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
0d286ef4e3e5c8462a89727efe309b3fead46486590ab5d39f09a457060e38c6.exepid process 624 0d286ef4e3e5c8462a89727efe309b3fead46486590ab5d39f09a457060e38c6.exe 624 0d286ef4e3e5c8462a89727efe309b3fead46486590ab5d39f09a457060e38c6.exe 624 0d286ef4e3e5c8462a89727efe309b3fead46486590ab5d39f09a457060e38c6.exe -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
0d286ef4e3e5c8462a89727efe309b3fead46486590ab5d39f09a457060e38c6.exepid process 624 0d286ef4e3e5c8462a89727efe309b3fead46486590ab5d39f09a457060e38c6.exe 624 0d286ef4e3e5c8462a89727efe309b3fead46486590ab5d39f09a457060e38c6.exe 624 0d286ef4e3e5c8462a89727efe309b3fead46486590ab5d39f09a457060e38c6.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
0d286ef4e3e5c8462a89727efe309b3fead46486590ab5d39f09a457060e38c6.exedescription pid process target process PID 624 wrote to memory of 1724 624 0d286ef4e3e5c8462a89727efe309b3fead46486590ab5d39f09a457060e38c6.exe RegAsm.exe PID 624 wrote to memory of 1724 624 0d286ef4e3e5c8462a89727efe309b3fead46486590ab5d39f09a457060e38c6.exe RegAsm.exe PID 624 wrote to memory of 1724 624 0d286ef4e3e5c8462a89727efe309b3fead46486590ab5d39f09a457060e38c6.exe RegAsm.exe PID 624 wrote to memory of 1724 624 0d286ef4e3e5c8462a89727efe309b3fead46486590ab5d39f09a457060e38c6.exe RegAsm.exe PID 624 wrote to memory of 1724 624 0d286ef4e3e5c8462a89727efe309b3fead46486590ab5d39f09a457060e38c6.exe RegAsm.exe PID 624 wrote to memory of 1724 624 0d286ef4e3e5c8462a89727efe309b3fead46486590ab5d39f09a457060e38c6.exe RegAsm.exe PID 624 wrote to memory of 1724 624 0d286ef4e3e5c8462a89727efe309b3fead46486590ab5d39f09a457060e38c6.exe RegAsm.exe PID 624 wrote to memory of 1724 624 0d286ef4e3e5c8462a89727efe309b3fead46486590ab5d39f09a457060e38c6.exe RegAsm.exe PID 624 wrote to memory of 1724 624 0d286ef4e3e5c8462a89727efe309b3fead46486590ab5d39f09a457060e38c6.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0d286ef4e3e5c8462a89727efe309b3fead46486590ab5d39f09a457060e38c6.exe"C:\Users\Admin\AppData\Local\Temp\0d286ef4e3e5c8462a89727efe309b3fead46486590ab5d39f09a457060e38c6.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v2.0.50727\\\\RegAsm.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1724
-